refactor(tui): extract change watcher into tui_gateway/change_watcher (server.py god-file slice R2)

[andrexibiza]

Summary

tui_gateway/server.py god-file slice R2: extract the change-watcher cluster from tui_gateway/server.py into tui_gateway/change_watcher.py. Part of the repo-wide large-file decomposition (tracker #78647).

What changed and why

• Change-watcher cluster (window 3179–3451, golden sha 33fff84c…, 13 moved names incl. resolve_skin, _ensure_skin_watcher) → tui_gateway/change_watcher.py
• server.py re-exports all 13 identity-preserving; import placed before _CHANGE_WATCHES (which references moved sig functions) — no NameError ordering trap
• Import-cycle-proof by construction: change_watcher.py imports tui_gateway.server at the END of the module (anti-deadlock placement), proven by test_import_order_cycle_permutation (change-watcher-first, server-first, entry/ws)
• _last_skin_sig deliberately stays server-owned (test_protocol patches it; moved code reads/writes server._last_skin_sig at call time)
• Double-blind: 2 analysts → consensus → implementer → 2 blind re-reviewers (both APPROVED, no CRITICAL/IMPORTANT)

Testing

• 63 tests pass (test_change_watcher.py + seam tests with per-name identity assertions)
• test_reexport_identity_per_moved_name asserts identity per re-exported name
• Import-cycle permutation tests (both orders + entry/ws) pass
• Golden sha 33fff84cb07e… verified against parent
• ruff clean · git diff --check clean · LF-only · DCO signed

Coordination / interlock

• Epic: Part of [COMPLETE] Large-file decomposition: 20/20 done #78647 · Target issue: Part of Shard tui_gateway/server.py (god-file decomposition) #78630
• Sibling PRs: the 4 other tui slices — disjoint clusters
• Dedup: no existing PR extracts the change watcher
• Credit: seam = HandlerRegistry globals-rebinding contract; pattern follows the web_server wave

Part of #78647
Part of #78630

[andrexibiza]

🔒 This shard is part of the tui_gateway/server.py KILL LOCK — the permanent record of the 13,908-line whole, the mess it caused (#60654 WS-frame stalls/frozen desktop, #60800 cold-start stalls, #33503 shell injection, #76285 board-slug validation, #76701 SessionDB abandonment, FIPS crashes), every shard in the wave, and every open fixer PR still fighting the surface (#72370 #76366 #67628 #58339 #77391 #66874 #77745 #72231 #62598 #33503 #74408 #74350 #65192 #77860 #76298 #78036 #74701 #72295 #73800 #76131 #68468 #51596 #53373 #76701 #70226).

Lock: posted on #78630 · Indexed by the Kill All Gods meta-issue #78647.